Privacy Policy

This policy explains what personal data TubeRise ("we") collects, why, and what rights you have under the EU General Data Protection Regulation (GDPR).

Data controller

Nick Akrami, trading as Made By Nick, Moosfeldstraße 6a, 85238 Petershausen, Germany. Contact: [email protected].

What we collect and why

• Account data — name, email, profile image via Google Sign-In (OAuth). Legal basis: performance of contract (Art. 6(1)(b) GDPR).
• YouTube channel data — channel and video metadata, read, and — when you apply an optimization suggestion — updated (title/description/tags only), via the YouTube Data API with your consent when you connect a channel. Legal basis: consent (Art. 6(1)(a)) and performance of contract.
• AI-generated suggestions — to generate video ideas and optimization suggestions, we send channel and video titles, descriptions, and performance metrics (e.g. view/like/comment counts) to our AI provider, OpenRouter (see Processors below). Legal basis: performance of contract.
• Usage & credit data — feature usage and credit balance, to operate the subscription/credit system. Legal basis: performance of contract.
• Payment data — subscription and billing details processed by our payment provider, Paddle.com Market Ltd. We do not see or store full card details. Legal basis: performance of contract.
• Session cookies — strictly necessary cookies set by our authentication system (NextAuth/Auth.js) to keep you signed in and protect against CSRF. These are exempt from cookie consent under TTDSG §25(2) as they are essential to the service.

We do not currently use analytics, advertising, or marketing cookies. If that changes, this policy and the cookie notice will be updated first, and consent will be requested where required.

Processors

• Google (OAuth sign-in, YouTube Data API)
• Paddle.com Market Ltd (payment processing, billing)
• Contabo GmbH (hosting and database, servers located in Germany)
• OpenRouter, Inc. (AI-powered idea generation and optimization suggestions — we send channel and video titles, descriptions, and performance metrics as input; OpenRouter is US-based and may route requests to AI model providers located outside the EU/EEA)
• Datadog (application performance monitoring; EU region, datadoghq.eu)

We currently do not send transactional email beyond account notifications from our own systems ([email protected]). Google, Paddle, Contabo, and Datadog operate within the EU/EEA. OpenRouter is based in the US and processing through it may involve transfers of data outside the EU/EEA; the specific contractual transfer safeguards (e.g. Standard Contractual Clauses, vendor DPA) have not yet been confirmed by a licensed professional, and this paragraph should not be relied on as a compliance guarantee until that review is complete.

Sharing of Google user data

We do not sell, rent, or trade Google user data (including YouTube channel and video data) to third parties. We do not share it for advertising purposes. We share it only with:

• The processors listed above — and only the minimum data each needs to perform its function (e.g. Paddle never receives YouTube data; Contabo only stores it as our infrastructure provider and does not access it; OpenRouter receives only the channel and video titles, descriptions, and performance metrics needed to generate the AI suggestions you request — never your Google account credentials or OAuth tokens).
• Law enforcement or regulators, only when legally required to do so.
• A successor entity in the event of a merger or acquisition, subject to this same policy.

TubeRise's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Protection of sensitive data

YouTube account data accessed via Google OAuth is treated as sensitive data and protected as follows:

• Encrypted in transit (TLS/HTTPS) between your browser, our servers, and Google's APIs.
• Encrypted at rest in our PostgreSQL database.
• OAuth access and refresh tokens are stored server-side only, never exposed to the browser or third parties, and are used solely to make the specific API calls described above.
• Access is restricted to the systems and personnel that operate TubeRise; we do not grant blanket database access to staff.
• Deleted on account deletion per the retention schedule below; you can also revoke access at any time from your Google Account permissions page.

Retention

We retain account data for as long as your account is active. If you delete your account, we delete your account and usage data within 30 days, and any backups containing it within 90 days. Invoicing and billing records are retained for 10 years as required by German tax law (§ 147 AO), regardless of account status.

Your rights

Under the GDPR, you have the right to:

• Access the personal data we hold about you (Art. 15)
• Request correction of inaccurate data (Art. 16)
• Request erasure ("right to be forgotten") (Art. 17)
• Request restriction of processing (Art. 18)
• Data portability (Art. 20)
• Object to processing (Art. 21)
• Lodge a complaint with your local data protection authority

To exercise any of these rights, contact us at [email protected].

Changes to this policy

We will post any changes to this policy on this page and update the date above.